cinematic-shot
Pass
Audited by Gen Agent Trust Hub on Oct 15, 2026
Risk Level: SAFEDYNAMIC_EXECUTIONINDIRECT_PROMPT_INJECTIONCOMMAND_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The skill provides detailed architectural instructions for generating and executing scripts at runtime to perform media rendering. It specifically mandates the use of Playwright for headless browser automation and WebGL2 for frame computation.
- Evidence: The
<build>section inreferences/landing-page-promo.mdoutlines a multi-step process for capturing UI elements, managing state in JSON, and rendering video frames. - [INDIRECT_PROMPT_INJECTION]: The skill processes user-provided external URLs (landing pages). This creates an attack surface where a malicious page could attempt to influence the agent's logic or data extraction process.
- Ingestion points: Landing page links requested in
references/landing-page-promo.md. - Boundary markers: Absent. The skill does not define clear delimiters or instructions to ignore content embedded within the target landing page.
- Capability inventory: Full headless browser control via Playwright, file system access (writing screenshots and JSON data), and GPU-accelerated rendering.
- Sanitization: Absent. There is no mention of sanitizing or filtering the content of the captured landing page before processing it into the video pipeline.
- [COMMAND_EXECUTION]: The skill specifies low-level command-line arguments for the browser execution environment to ensure hardware acceleration.
- Evidence:
references/landing-page-promo.mdinstructs the use of--use-angle=d3d11,--enable-gpu, and--ignore-gpu-blocklistflags.
Audit Metadata